AMENDMENTS TO THE CLAIMS: 

Without prejudice, this listing of the claims replaces all prior versions and listings 
of the claims in the present application: 

LISTING OF CLAIMS ; 

Claim 1. (Canceled). 

2. (Previously Presented) A method for verifying safety properties of a Java byte code 
program, the method comprising: 

mapping a functioning of the byte code program by a potentially infinite state 
transition system onto a finite state transition system using an algorithm describing first 
properties of byte code instructions, 

mapping a state space of an interpreter onto a finite set of states in the finite state 
transition system, information not needed for a checking of an acceptability of the byte 
code program being omitted, so that the finite state transition system contains only type 
information useable for the checking of the acceptability of the byte code program; 

entering the type information useable for the checking of the acceptability of the 
byte code program into a model checker; 

determining second properties which characterize an acceptable byte code 
program using a logic operation including formulas; 

entering the determined second properties which characterize an acceptable byte 
code program as conditional set into the model checker, the conditional set including a 
plurality of individual conditions; 

interpreting, using the model checker, each of the plurality of individual 
conditions as a specification language for system properties of the byte code program; 

verifying, using the model checker, whether each of the plurality of individual 
conditions is fulfilled by the state transition system; and then 

automatically releasing the byte code program for further processing when the 
state transition system fulfills all of the plurality of individual conditions. 
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3. (Previously Presented) The method as recited in claim 2 wherein the interpreter is a 
java virtual machine. 
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